patients/get_patient_info.php

   1     <?php
   2  // Copyright (C) 2011 Cassian LUP <cassi.lup@gmail.com>
   3  //
   4  // This program is free software; you can redistribute it and/or
   5  // modify it under the terms of the GNU General Public License
   6  // as published by the Free Software Foundation; either version 2
   7  // of the License, or (at your option) any later version.
   8
   9     //starting the PHP session (also regenerating the session id to avoid session fixation attacks)
  10         session_start();
  11         session_regenerate_id(true);
  12     //
  13
  14     //landing page definition -- where to go if something goes wrong
  15         $landingpage = "index.php?site=".$_SESSION['site_id'];
  16     //
  17
  18     //checking whether the request comes from index.php
  19         if (!isset($_SESSION['itsme'])) {
  20                 session_destroy();
  21                 header('Location: '.$landingpage.'&w');
  22                 exit;
  23         }
  24     //
  25
  26     //some validation
  27         if (!isset($_POST['uname']) || empty($_POST['uname'])) {
  28                 session_destroy();
  29                 header('Location: '.$landingpage.'&w&c');
  30                 exit;
  31         }
  32         if (!isset($_POST['pass']) || empty($_POST['pass'])) {
  33                 session_destroy();
  34                 header('Location: '.$landingpage.'&w&c');
  35                 exit;
  36         }
  37     //
  38
  39     // set the language
  40     if (!empty($_POST['languageChoice'])) {
  41             $_SESSION['language_choice'] = (int)$_POST['languageChoice'];
  42     }
  43     else if (empty($_SESSION['language_choice'])) {
  44             // just in case both are empty, then use english
  45             $_SESSION['language_choice'] = 1;
  46     }
  47     else {
  48             // keep the current session language token
  49     }
  50
  51     //SANITIZE ALL ESCAPES
  52     $fake_register_globals=false;
  53
  54     //STOP FAKE REGISTER GLOBALS
  55     $sanitize_all_escapes=true;
  56
  57     //Settings that will override globals.php
  58     $ignoreAuth = 1;
  59     //
  60
  61     //Authentication
  62         require_once('../interface/globals.php');
  63     require_once("$srcdir/authentication/common_operations.php");
  64     $password_update=isset($_SESSION['password_update']);
  65     unset($_SESSION['password_update']);
  66     $plain_code= $_POST['pass'];
  67
  68
  69     $authorizedPortal=false; //flag
  70     DEFINE("TBL_PAT_ACC_ON","patient_access_onsite");
  71     DEFINE("COL_PID","pid");
  72     DEFINE("COL_POR_PWD","portal_pwd");
  73     DEFINE("COL_POR_USER","portal_username");
  74     DEFINE("COL_POR_SALT","portal_salt");
  75     DEFINE("COL_POR_PWD_STAT","portal_pwd_status");
  76     $sql= "SELECT ".implode(",",array(COL_ID,COL_PID,COL_POR_PWD,COL_POR_SALT,COL_POR_PWD_STAT))
  77           ." FROM ".TBL_PAT_ACC_ON
  78           ." WHERE ".COL_POR_USER."=?";
  79             $auth = privQuery($sql, array($_POST['uname']));
  80             if($auth===false)
  81             {
  82                 session_destroy();
  83                 header('Location: '.$landingpage.'&w');
  84                 exit;
  85             }
  86             if(empty($auth[COL_POR_SALT]))
  87             {
  88                 if(SHA1($plain_code)!=$auth[COL_POR_PWD])
  89                 {
  90                     session_destroy();
  91                     header('Location: '.$landingpage.'&w');
  92                     exit;
  93                 }
  94                 $new_salt=oemr_password_salt();
  95                 $new_hash=oemr_password_hash($plain_code,$new_salt);
  96                 $sqlUpdatePwd= " UPDATE " . TBL_PAT_ACC_ON
  97                               ." SET " .COL_POR_PWD."=?, "
  98                               . COL_POR_SALT . "=? "
  99                               ." WHERE ".COL_ID."=?";
 100                 privStatement($sqlUpdatePwd,array($new_hash,$new_salt,$auth[COL_ID]));
 101             }
 102             else {
 103                 if(oemr_password_hash($plain_code,$auth[COL_POR_SALT])!=$auth[COL_POR_PWD])
 104                 {
 105                     session_destroy();
 106                     header('Location: '.$landingpage.'&w');
 107                     exit;
 108
 109                 }
 110
 111             }
 112             $_SESSION['portal_username']=$_POST['uname'];
 113     $sql = "SELECT * FROM `patient_data` WHERE `pid` = ?";
 114
 115     if ($userData = sqlQuery($sql, array($auth['pid']) )) { // if query gets executed
 116
 117         if (empty($userData)) {
 118                             // no records for this pid, so escape
 119             session_destroy();
 120                             header('Location: '.$landingpage.'&w');
 121             exit;
 122                     }
 123
 124         if ($userData['allow_patient_portal'] != "YES") {
 125             // Patient has not authorized portal, so escape
 126             session_destroy();
 127                             header('Location: '.$landingpage.'&w');
 128             exit;
 129                     }
 130
 131         if ($auth['pid'] != $userData['pid']) {
 132             // Not sure if this is even possible, but should escape if this happens
 133             session_destroy();
 134             header('Location: '.$landingpage.'&w');
 135             exit;
 136         }
 137
 138         if ( $password_update)
 139             {
 140                 $code_new=$_POST['pass_new'];
 141                 $code_new_confirm=$_POST['pass_new_confirm'];
 142                 if(!(empty($_POST['pass_new'])) && !(empty($_POST['pass_new_confirm'])) && ($code_new == $code_new_confirm)) {
 143                 $new_salt=oemr_password_salt();
 144                 $new_hash=oemr_password_hash($code_new,$new_salt);
 145
 146                 // Update the password and continue (patient is authorized)
 147                 privStatement("UPDATE ".TBL_PAT_ACC_ON
 148                               ."  SET ".COL_POR_PWD."=?,".COL_POR_SALT."=?,".COL_POR_PWD_STAT."=1 WHERE id=?", array($new_hash,$new_salt,$auth['id']) );
 149                 $authorizedPortal = true;
 150             }
 151         }
 152         if ($auth['portal_pwd_status'] == 0) {
 153             if(!$authorizedPortal) {
 154                 // Need to enter a new password in the index.php script
 155                 $_SESSION['password_update'] = 1;
 156                                 header('Location: '.$landingpage);
 157                 exit;
 158             }
 159         }
 160
 161         if ($auth['portal_pwd_status'] == 1) {
 162             // continue (patient is authorized)
 163             $authorizedPortal = true;
 164         }
 165
 166         if ($authorizedPortal) {
 167                         // patient is authorized (prepare the session variables)
 168             unset($_SESSION['password_update']); // just being safe
 169             unset($_SESSION['itsme']); // just being safe
 170             $_SESSION['pid'] = $auth['pid'];
 171             $_SESSION['patient_portal_onsite'] = 1;
 172         }
 173         else {
 174             session_destroy();
 175             header('Location: '.$landingpage.'&w');
 176             exit;
 177         }
 178
 179     }
 180     else { //problem with query
 181         session_destroy();
 182         header('Location: '.$landingpage.'&w');
 183         exit;
 184     }
 185
 186     require_once('summary_pat_portal.php');
 187
 188 ?>